@abot-ai/runtime 1.5.0 → 1.7.0

package/dist/src/web-ui/app/components/system-host/connection-card.js

@@ -0,0 +1,35 @@
+import { escapeHtml } from "../../lib/text-format.js";
+
+export function renderComputerMetadata(snapshot, disabled = false) {
+  const identity = snapshot?.identity || {};
+  const os = { windows: "Windows", macos: "macOS", linux: "Linux" }[identity.os] || identity.os;
+  const summary = [identity.name, os, identity.user]
+    .filter((value) => typeof value === "string" && value.length > 0).join(" · ");
+  if (!summary && !snapshot?.paired) return "";
+  return `<div class="system-host-card-computer"><span>${escapeHtml(summary)}</span>${snapshot?.paired ? `<button type="button" data-system-host-revoke title="Disconnect this computer. Saved insights are kept." ${disabled ? "disabled" : ""}>Remove this computer</button>` : ""}</div>`;
+}
+
+function renderConnectionStatus(status, ready, compact = false) {
+  return `<span class="system-host-card-status" role="status" ${compact ? `aria-label="${escapeHtml(status)}"` : ""} data-tone="${ready ? "ready" : "unavailable"}"><i aria-hidden="true"></i>${compact ? "" : escapeHtml(status)}</span>`;
+}
+
+/** Platform actions are supplied by their existing owners; this module renders the shared layout. */
+export function renderConnectionCard({
+  title, status, ready, disabled = false, compact = false, description = "",
+  actions = "", help = "", metadata = "", error = "", message = "", details = "", attributes = "",
+}) {
+  if (compact) return `<section class="system-host-panel system-host-card system-host-card-ready" aria-label="Computer access" ${attributes}>
+    <h2 class="system-host-card-ready-title">${renderConnectionStatus(status, ready, true)}${escapeHtml(title)}</h2>
+    ${metadata}
+    ${details}
+  </section>`;
+  return `<section class="system-host-panel system-host-card" aria-label="Computer access" aria-busy="${disabled ? "true" : "false"}" ${attributes}>
+    <div class="system-host-card-heading"><h2>${escapeHtml(title)}</h2>${renderConnectionStatus(status, ready)}</div>
+    ${description ? `<p class="system-host-card-description">${escapeHtml(description)}</p>` : ""}
+    ${actions ? `<div class="system-host-card-action">${actions}</div>` : ""}
+    ${help ? `<p class="system-host-card-hint">${escapeHtml(help)}</p>` : ""}
+    ${error || message ? `<p class="${error ? "error-text" : "system-host-card-message"}" role="${error ? "alert" : "status"}" aria-live="polite">${escapeHtml(error || message)}</p>` : ""}
+    ${metadata}
+    ${details}
+  </section>`;
+}

package/dist/src/web-ui/app/components/system-host/macos-permission-preparation.js

@@ -0,0 +1,83 @@
+import { hasCompletePermissionReceipt, macPermissionScopes } from "./macos-permission-scopes.js";
+
+export function createMacPermissionPreparation({
+  state, requestPermissions, beginRequest, finishRequest, isCurrentResponse,
+  getSurfaceRevision, isVisible, getEnvironmentId,
+}) {
+  function clear() {
+    for (const route of Object.values(macPermissionScopes)) {
+      state[route.receiptKey] = null;
+      state[route.errorKey] = "";
+    }
+  }
+  function reconcile() {
+    for (const route of Object.values(macPermissionScopes)) {
+      if (route.matches(state[route.receiptKey], state.snapshot, getEnvironmentId())) continue;
+      state[route.receiptKey] = null;
+      state[route.errorKey] = "";
+    }
+  }
+  function canPreparePermissions(route) {
+    if (state.busy || state.statusUnavailable) return false;
+    if (!isVisible()) return false;
+    if (typeof requestPermissions !== "function") return false;
+    return route.canCheck(state.snapshot, getEnvironmentId());
+  }
+  function canApplyPermissionResponse(operation, surface, route, binding) {
+    if (!isCurrentResponse(operation)) return false;
+    if (surface !== getSurfaceRevision()) return false;
+    if (!isVisible()) return false;
+    return route.matches(binding, state.snapshot, getEnvironmentId());
+  }
+  function permissionStillRequired(permission, route) {
+    const receipt = state[route.receiptKey];
+    if (!route.matches(receipt, state.snapshot, getEnvironmentId())) return false;
+    if (permission === "screen_recording")
+      return receipt.permissions.screenRecording === "required";
+    if (permission === "accessibility")
+      return receipt.permissions.accessibility === "required";
+    return false;
+  }
+  async function prepare(permission, scope = "companion") {
+    const route = macPermissionScopes[scope];
+    if (!route || !canPreparePermissions(route)) return false;
+    if (permission && !permissionStillRequired(permission, route)) return false;
+    const binding = route.binding(state.snapshot);
+    const surface = getSurfaceRevision();
+    state[route.errorKey] = "";
+    const operation = beginRequest();
+    try {
+      const receipt = await requestPermissions({
+        ...binding,
+        action: permission ? "request" : "check",
+        ...(permission ? { permission } : {}),
+      });
+      if (!canApplyPermissionResponse(operation, surface, route, binding)) return false;
+      if (!route.matches(receipt, state.snapshot, getEnvironmentId()))
+        throw new Error("permission_receipt_binding_invalid");
+      if (receipt.scope !== scope || !hasCompletePermissionReceipt(receipt))
+        throw new Error("permission_receipt_unavailable");
+      state[route.receiptKey] = receipt;
+      return true;
+    } catch {
+      if (!canApplyPermissionResponse(operation, surface, route, binding)) return false;
+      state[route.receiptKey] = null;
+      state[route.errorKey] = "Permission preparation could not complete. Check the executing Mac, its macOS 14 or later version and Swift developer tools. Refresh the connection, then check again.";
+      return false;
+    } finally {
+      finishRequest(operation);
+    }
+  }
+  function afterPaint(root) {
+    for (const [scope, route] of Object.entries(macPermissionScopes)) {
+      root?.querySelector(`[data-${route.selector}-permissions-check]`)
+        ?.addEventListener("click", () => void prepare(undefined, scope));
+      for (const permission of ["screen_recording", "accessibility"])
+        root?.querySelector(`[data-${route.selector}-permission-request="${permission}"]`)
+          ?.addEventListener("click", () => void prepare(permission, scope));
+    }
+  }
+  return { clear, reconcile, afterPaint, checkPermissions: () => prepare(), requestPermission: prepare,
+    checkNativePermissions: () => prepare(undefined, "native_runtime"),
+    requestNativePermission: permission => prepare(permission, "native_runtime") };
+}

package/dist/src/web-ui/app/components/system-host/macos-permission-rendering.js

@@ -0,0 +1,85 @@
+import { escapeHtml } from "../../lib/text-format.js";
+import { canCheckMacPermissions, canCheckNativePermissions, permissionsMatchConnection, permissionsMatchNativeOwner } from "./macos-permission-scopes.js";
+
+function hasNativePermissionSurface(snapshot) {
+  if (snapshot?.identity?.os === "macos") return true;
+  if (!snapshot?.nativePermissions) return false;
+  return snapshot.nativePermissions.reason !== "native_macos_unavailable";
+}
+function permissionSummary(receipt) {
+  if (!receipt) return "not checked";
+  if (receipt.permissions.screenRecording !== "granted") return "action needed";
+  if (receipt.permissions.accessibility !== "granted") return "action needed";
+  return "granted";
+}
+export function macPermissionSummary(snapshot, receipt, nativeReceipt) {
+  const parts = [];
+  if (hasNativePermissionSurface(snapshot)) {
+    const native = snapshot.nativePermissions;
+    const current = permissionsMatchNativeOwner(nativeReceipt, snapshot, native?.environmentId) ? nativeReceipt : null;
+    parts.push(`SYSTEM · ${native?.available ? permissionSummary(current) : "unavailable"}`);
+  }
+  if (snapshot?.identity?.os === "macos" && snapshot.connected) {
+    const current = permissionsMatchConnection(receipt, snapshot) ? receipt : null;
+    parts.push(`Companion · ${canCheckMacPermissions(snapshot) ? permissionSummary(current) : "update needed"}`);
+  }
+  return parts.join(" · ");
+}
+function permissionStatusLabel(status) {
+  if (status === "granted") return "Granted";
+  if (status === "required") return "Required";
+  return "Not checked";
+}
+function permissionRow(label, permission, status, selector, disabled) {
+  return `<div class="system-host-permission-row"><strong>${label}</strong>
+    <span class="system-host-permission-state" data-granted="${status === "granted"}">${permissionStatusLabel(status)}</span>
+    ${status === "required" ? `<button type="button" data-${selector}-permission-request="${permission}" ${disabled ? "disabled" : ""}>Allow ${label}</button>` : ""}</div>`;
+}
+function renderPermissionRoute({ title, description, selector, available, receipt, identity, permissionHelp, error, disabled }) {
+  return `<section class="system-host-permission-route" data-permission-route="${selector}">
+    <div class="system-host-permission-heading"><h4>${title}</h4>
+      ${available ? `<button type="button" data-${selector}-permissions-check ${disabled ? "disabled" : ""}>${receipt ? "Check again" : "Check permissions"}</button>` : ""}</div>
+    <p class="system-host-note">${escapeHtml(description)}</p>
+    ${available ? permissionRow("Screen Recording", "screen_recording", receipt?.permissions.screenRecording, selector, disabled) + permissionRow("Accessibility", "accessibility", receipt?.permissions.accessibility, selector, disabled) : ""}
+    ${identity ? `<p class="system-host-note">${identity}</p>` : ""}
+    ${receipt ? `<code class="system-host-permission-path" dir="ltr">${escapeHtml(receipt.executablePath)}</code><p class="system-host-note">${permissionHelp} After changing access, choose Check again.${receipt.restartMayBeRequired ? " macOS may require a restart before the new access takes effect; finish setup before starting a conversation." : ""}</p>` : ""}
+    ${error ? `<p role="alert" class="error-text">${escapeHtml(error)}</p>` : ""}
+  </section>`;
+}
+function nativeUnavailableDescription(native) {
+  if (!native) return "Update ABot to check the native SYSTEM route. Companion approval does not confirm SYSTEM access.";
+  if (native.reason === "native_macos_unavailable") return "The selected Runtime is not running natively on macOS. Companion permissions do not grant SYSTEM access on another computer.";
+  if (native.reason === "local_browser_required") return "Open ABot’s local Web UI on the Mac running the Runtime to prepare SYSTEM permissions.";
+  if (native.reason === "runtime_not_started") return "Start the selected Runtime, then refresh Computer access to prepare SYSTEM permissions.";
+  return "The selected Runtime cannot report its permission identity. Update or reconnect it, then refresh Computer access.";
+}
+export function renderMacPermissionPreparation({ snapshot, macPermissions, macPermissionError, nativeMacPermissions, nativeMacPermissionError, busy, statusUnavailable }) {
+  const showNative = hasNativePermissionSurface(snapshot);
+  const showCompanion = snapshot?.identity?.os === "macos" && snapshot.paired;
+  if (!showNative && !showCompanion) return "";
+  const native = snapshot.nativePermissions;
+  const nativeAvailable = canCheckNativePermissions(snapshot, native?.environmentId);
+  const nativeReceipt = permissionsMatchNativeOwner(nativeMacPermissions, snapshot, native?.environmentId) ? nativeMacPermissions : null;
+  const companionAvailable = canCheckMacPermissions(snapshot);
+  const companionReceipt = permissionsMatchConnection(macPermissions, snapshot) ? macPermissions : null;
+  const disabled = busy || statusUnavailable;
+  return `<section class="system-host-permissions" data-system-host-mac-permissions aria-label="macOS permission preparation">
+    <h3>Prepare Mac permissions before a conversation</h3>
+    <p class="system-host-note">SYSTEM and the companion can run under different apps or on different computers. Check each route you use. Checks do not capture content or start Spark; Allow buttons explicitly request access.</p>
+    ${showNative ? renderPermissionRoute({
+      title: "SYSTEM · ABot Runtime", selector: "native-mac", available: nativeAvailable, receipt: nativeReceipt,
+      description: nativeAvailable ? "Direct SYSTEM commands use the selected Runtime’s permissions. Allow Terminal or the application shown by macOS. If asked to reopen it, do so before starting a conversation, then check again." : nativeUnavailableDescription(native),
+      identity: nativeAvailable ? `Runtime computer: <strong>${escapeHtml(native.computerName)}</strong> · Environment: <strong>${escapeHtml(native.environmentId)}</strong>` : "",
+      permissionHelp: "This path identifies the Runtime process; macOS may assign its permissions to Terminal or the application that started it.",
+      error: nativeMacPermissionError, disabled,
+    }) : ""}
+    ${showCompanion ? renderPermissionRoute({
+      title: "Computer tools · ABot companion", selector: "mac", available: companionAvailable, receipt: companionReceipt,
+      description: companionAvailable ? "Screen capture and computer control through the connected companion. Spark collection is controlled separately." : "Connect or update the Mac companion to check its permissions here.",
+      identity: `Companion computer: <strong>${escapeHtml(snapshot.identity.name || "Connected Mac")}</strong>`,
+      permissionHelp: "macOS may label the companion “node”. Match this exact path in System Settings → Privacy &amp; Security.",
+      error: macPermissionError, disabled,
+    }) : ""}
+    <p class="system-host-note">These checks cover Screen Recording and Accessibility. Access to protected folders and automation of individual apps can require additional approval.</p>
+  </section>`;
+}

package/dist/src/web-ui/app/components/system-host/macos-permission-scopes.js

@@ -0,0 +1,51 @@
+/** Each receipt belongs to its executing process, never the browser computer. */
+export function canCheckMacPermissions(snapshot) {
+  if (snapshot?.identity?.os !== "macos") return false;
+  if (!snapshot.connected) return false;
+  if (!snapshot.hostId || !snapshot.connectionId) return false;
+  if (snapshot.readiness?.companionUpdateRequired) return false;
+  return snapshot.capabilities?.includes("macos_permission_preflight_v1") === true;
+}
+
+export function permissionsMatchConnection(receipt, snapshot) {
+  if (!receipt || !canCheckMacPermissions(snapshot)) return false;
+  if (receipt.hostId !== snapshot.hostId) return false;
+  return receipt.connectionId === snapshot.connectionId;
+}
+
+export function canCheckNativePermissions(snapshot, environmentId) {
+  const native = snapshot?.nativePermissions;
+  if (native?.available !== true) return false;
+  if (native.scope !== "native_runtime") return false;
+  if (typeof native.ownerId !== "string" || !native.ownerId) return false;
+  return native.environmentId === environmentId;
+}
+
+export function permissionsMatchNativeOwner(receipt, snapshot, environmentId) {
+  if (!receipt || !canCheckNativePermissions(snapshot, environmentId)) return false;
+  if (receipt.scope !== "native_runtime") return false;
+  if (receipt.environmentId !== environmentId) return false;
+  return receipt.ownerId === snapshot.nativePermissions.ownerId;
+}
+
+export function hasCompletePermissionReceipt(receipt) {
+  if (receipt?.ok !== true) return false;
+  if (typeof receipt.executablePath !== "string") return false;
+  if (!receipt.executablePath.startsWith("/")) return false;
+  const statuses = ["granted", "required"];
+  if (!statuses.includes(receipt.permissions?.screenRecording)) return false;
+  return statuses.includes(receipt.permissions?.accessibility);
+}
+
+export const macPermissionScopes = {
+  companion: {
+    receiptKey: "macPermissions", errorKey: "macPermissionError", selector: "mac",
+    canCheck: canCheckMacPermissions, matches: permissionsMatchConnection,
+    binding: snapshot => ({ hostId: snapshot.hostId, connectionId: snapshot.connectionId }),
+  },
+  native_runtime: {
+    receiptKey: "nativeMacPermissions", errorKey: "nativeMacPermissionError", selector: "native-mac",
+    canCheck: canCheckNativePermissions, matches: permissionsMatchNativeOwner,
+    binding: snapshot => ({ scope: "native_runtime", environmentId: snapshot.nativePermissions.environmentId, ownerId: snapshot.nativePermissions.ownerId }),
+  },
+};

package/dist/src/web-ui/app/components/system-host/macos-setup.js

@@ -58,7 +58,7 @@ export function renderMacSetupAction(snapshot, disabled) {
     : "Connect this Mac";
   const label = local ? localLabel : "Connect a Mac";
   const action = local ? "local" : "manual";
-  return `<button type="button" data-system-host-mac="${action}" ${disabled ? "disabled" : ""}>${label}</button>`;
+  return `<button type="button" class="system-host-card-primary" data-system-host-mac="${action}" ${disabled ? "disabled" : ""}>${label}</button>`;
 }
 
 export function renderMacSetupNotice(snapshot) {

package/dist/src/web-ui/app/components/system-host/manager.js

@@ -2,12 +2,17 @@ import { downloadHostSetup } from "./download.js";
 import { hostSetupIsReady, renderSystemHostConnection } from "./rendering.js";
 import { createSystemHostVisibility } from "./visibility.js";
 import { createMacConnectionActions } from "./macos-connection-actions.js";
+import { createMacPermissionPreparation } from "./macos-permission-preparation.js";
+import { createWindowsStoreConnectionActions, windowsStoreSetupIsAvailable } from "./windows-store-setup.js";
 
 export function createSystemHostConnectionManager({
   loadConnection,
   downloadSetup,
+  requestStoreConnection,
   connectLocal,
   createPairing,
+  requestPermissions,
+  getEnvironmentId = () => "",
   getRuntimeOrigin = () => globalThis.location?.origin,
   revokeConnection,
   supportsConnection = () => true,
@@ -29,7 +34,13 @@ export function createSystemHostConnectionManager({
     statusUnavailable: false,
     downloaded: null,
     manualMac: null,
+    windowsStoreInvitation: null,
+    windowsStoreAttempt: null,
     managementOpen: false,
+    macPermissions: null,
+    macPermissionError: "",
+    nativeMacPermissions: null,
+    nativeMacPermissionError: "",
   };
   let revision = 0;
   let pollTimer;
@@ -56,6 +67,17 @@ export function createSystemHostConnectionManager({
     getSurfaceRevision: () => surfaceRevision,
     isVisible: () => visibility.isVisible(),
   });
+  const permissions = createMacPermissionPreparation({
+    state, requestPermissions, beginRequest, finishRequest, isCurrentResponse, getEnvironmentId,
+    getSurfaceRevision: () => surfaceRevision,
+    isVisible: () => visibility.isVisible(),
+  });
+  const windowsStore = createWindowsStoreConnectionActions({
+    state, requestStoreConnection, canInstallOnPlatform, beginRequest, finishRequest,
+    revokeConnection, receiveUnpairedConnection, getEnvironmentId,
+    isCurrentResponse, getSurfaceRevision: () => surfaceRevision,
+    isVisible: () => visibility.isVisible(), notify,
+  });
   function markup() {
     return renderSystemHostConnection({
       ...state,
@@ -65,6 +87,17 @@ export function createSystemHostConnectionManager({
     });
   }
   function afterPaint(root = state.root) {
+    permissions.afterPaint(root);
+    root?.querySelector("[data-system-host-store-connect]")
+      ?.addEventListener("click", () => void windowsStore.connectWindowsStore());
+    root?.querySelector("[data-system-host-store-launch]")
+      ?.addEventListener("click", windowsStore.markLaunchRequested);
+    root?.querySelector("[data-system-host-store-repair]")
+      ?.addEventListener("click", windowsStore.beginWindowsStoreRepair);
+    root?.querySelector("[data-system-host-store-repair-confirm]")
+      ?.addEventListener("click", () => void windowsStore.confirmWindowsStoreRepair());
+    root?.querySelector("[data-system-host-store-repair-cancel]")
+      ?.addEventListener("click", windowsStore.cancelWindowsStoreRepair);
     const management = root?.querySelector("[data-system-host-management]");
     management?.addEventListener("toggle", () => {
       if (management !== state.root?.querySelector("[data-system-host-management]")) return;
@@ -124,6 +157,8 @@ export function createSystemHostConnectionManager({
     wasVisible = visible;
     if (!visible) {
       state.manualMac = null;
+      windowsStore.clear({ preserveWaiting: true });
+      permissions.clear();
       notify();
       stopPolling();
       return;
@@ -133,8 +168,9 @@ export function createSystemHostConnectionManager({
   function isCurrentResponse(operation) {
     return operation === revision;
   }
-  function beginRequest(background = false) {
+  function beginRequest(background = false, preserveStoreWaiting = false) {
     stopPolling();
+    if (!background) windowsStore.clear({ preserveWaiting: preserveStoreWaiting });
     state.busy = !background;
     backgroundPending = background;
     if (!background) state.error = "";
@@ -158,14 +194,19 @@ export function createSystemHostConnectionManager({
       notify();
       return false;
     }
-    const operation = beginRequest(background);
+    const operation = beginRequest(background, true);
+    const environment = getEnvironmentId();
     try {
       const snapshot = await loadConnection();
       if (!isCurrentResponse(operation)) return false;
+      if (environment !== getEnvironmentId()) return false;
       state.snapshot = snapshot;
+      if (!windowsStoreSetupIsAvailable(snapshot)) windowsStore.clear();
+      permissions.reconcile();
       state.statusUnavailable = false;
       state.error = "";
       if (hostSetupIsReady(snapshot)) {
+        windowsStore.clear();
         state.manualMac = null;
         state.downloaded = null;
         state.message = "";
@@ -174,10 +215,10 @@ export function createSystemHostConnectionManager({
       return true;
     } catch {
       if (!isCurrentResponse(operation)) return false;
+      windowsStore.clear();
       state.statusUnavailable = true;
-      state.error = state.downloaded?.restartRequired
-        ? "Waiting for WSL and ABot to return after setup."
-        : "Could not check this computer. Refresh to try again.";
+      permissions.clear();
+      state.error = "Could not check this computer. Refresh to try again.";
       return false;
     } finally {
       finishRequest(operation);
@@ -198,6 +239,7 @@ export function createSystemHostConnectionManager({
   }
   async function install(platform) {
     if (platform === "macos") return false;
+    if (platform === "windows") return windowsStore.connectWindowsStore();
     if (!canInstallOnPlatform(platform)) return false;
     state.manualMac = null;
     const operation = beginRequest();
@@ -211,7 +253,6 @@ export function createSystemHostConnectionManager({
       state.downloaded = {
         filename: receipt.filename,
         expiresAt: receipt.expiresAt,
-        restartRequired: receipt.restartRequired === true,
       };
       state.message =
         "Setup downloaded. Open the downloaded file and follow its instructions. Waiting for verification…";
@@ -224,18 +265,23 @@ export function createSystemHostConnectionManager({
       finishRequest(operation);
     }
   }
+  function receiveUnpairedConnection(snapshot) {
+    state.snapshot = snapshot;
+    permissions.clear();
+    state.downloaded = null;
+    state.manualMac = null;
+    state.statusUnavailable = false;
+    state.message = "Computer unpaired.";
+  }
   async function revoke() {
     if (state.busy) return false;
     if (!supportsConnection()) return false;
+    windowsStore.clear();
     const operation = beginRequest();
     try {
       const snapshot = await revokeConnection();
       if (!isCurrentResponse(operation)) return false;
-      state.snapshot = snapshot;
-      state.downloaded = null;
-      state.manualMac = null;
-      state.statusUnavailable = false;
-      state.message = "Computer unpaired.";
+      receiveUnpairedConnection(snapshot);
       return true;
     } catch {
       if (isCurrentResponse(operation))
@@ -259,10 +305,12 @@ export function createSystemHostConnectionManager({
     state.statusUnavailable = false;
     state.downloaded = null;
     state.manualMac = null;
+    windowsStore.clear();
     state.error = "";
     state.actionError = "";
     state.message = "";
     state.managementOpen = false;
+    permissions.clear();
     stopPolling();
     wasVisible = false;
     render();
@@ -271,7 +319,26 @@ export function createSystemHostConnectionManager({
     state,
     load,
     install,
+    connectWindowsStore: windowsStore.connectWindowsStore,
+    beginWindowsStoreRepair: windowsStore.beginWindowsStoreRepair,
+    cancelWindowsStoreRepair: windowsStore.cancelWindowsStoreRepair,
+    confirmWindowsStoreRepair: windowsStore.confirmWindowsStoreRepair,
     ...mac,
+    checkPermissions: permissions.checkPermissions,
+    requestPermission: permissions.requestPermission,
+    checkNativePermissions: permissions.checkNativePermissions,
+    requestNativePermission: permissions.requestNativePermission,
+    environmentChanged() {
+      revision += 1;
+      surfaceRevision += 1;
+      state.busy = false;
+      backgroundPending = false;
+      state.snapshot = null;
+      windowsStore.clear();
+      permissions.clear();
+      notify();
+      if (visibility.isVisible()) void load();
+    },
     revoke,
     markup,
     afterPaint,